CVE-2025-56379

CVE-2025-56379 — Cross-Site Scripting XSS almacenado en ERPNext 15.67.0 / Frappe 15.72.4 📌 Resumen Existe una vulnerabilidad de Cross‑Site Scripting XSS almacenado en el módulo Blog de ERPNext v15.67.0 / Frappe v15.72.4. Un usuario autenticado que pueda crear o editar publicaciones de blog puede...

CVE-2025-56380

CVE-2025-56380 — Frappe / ERPNext 中的基于时间的盲 SQL 注入（frappe.client.getvalue） 📌 摘要 在 Frappe Framework v15.72.4 的 frappe.client.getvalue API 端点中（以及 ERPNext v15.67.0 代码库中）发现了一个基于时间的盲 SQL 注入漏洞。具有 reporting/client API 访问权限的已认证用户可以通过 fieldname 参数注入 SQL。通过将时间延迟函数（例如 sleep15）插入 fieldname...

CVE-2025-28062

CVE-2025-28062 — ERPNext 14.82.1、14.74.3におけるアカウント乗っ取りにつながるCSRF脆弱性 📌 概要 ERPNext 14.82.1および14.74.3 にクロスサイトリクエストフォージェリ（CSRF）脆弱性が発見されました。これにより攻撃者は以下のような不正な操作を実行できます： ユーザー列挙 アカウント乗っ取り（パスワードリセット） 任意のユーザー削除 権限昇格（ロールの追加） この脆弱性は、重要な管理APIエンドポイントにCSRF対策が欠如している...

CVE-2025-56381

CVE-2025-56381 — ERPNext / Frappe 中通过 orderby 和 groupby 参数实现的身份验证后 SQL 注入 📌 摘要 ERPNext v15.67.0 和 Frappe Framework v15.72.4 在 frappe.desk.reportview.get API 端点中包含多个身份验证后的 SQL 注入漏洞 。对 orderby 或 groupby 参数的恶意输入可用于注入并执行任意 SQL 语句。这使得经过身份验证的用户（具有报表的基本访问权限）能够提取敏感数据、执行数据库枚举，并可能操纵或提升系统内的权限。 🛠 技术细节 漏洞类型：...

CVE-2022-28598

ERPNext - 12.29.0 在 ERPNext 12.29.0 的“我的设置”（My Setting）页面中，“lastknownversion”字段存在存储型跨站脚本（XSS）漏洞。远程攻击者可通过构造站点名称，并向 '/deskForm/User/Authenticated User' 发送经过身份验证的 POST HTTP 请求，从而注入任意 Web 脚本或 HTML，并将脚本注入“lastknownversion”字段中，之后我们可通过点击“pdf”视图表单查看该脚本。 此漏洞特指“我的设置”（My...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

EUVD-2026-85344

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 are vulnerable to an unauthorized method invocation due to insufficient validation of calculation_formula values within Financial Report Templates. The application fails to verify that these values reference whitelisted methods before passing them to frappe....

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672: Use of Externally-Controlled Input to Select Classes or Code

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

PT-2026-97358

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.1 Description Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the calculation formula values...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

EUVD-2026-83735

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113: Missing Authorization

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...